critical iauth fix (Re: new vulnerability)

[Christophe Kalt <kalt@xxxxxxxxxxx>]

The patch posted a while back by Michal 'pht' Svoboda is now
also available from ftp.irc.org

While this is not the best way to fix the problem, it works
and has the advantage of not requiring ircd to be restarted
to be put in place.

For completeness, I must add that not running iauth is the
only correct workaround (unlike stated in my previous post),
and that all 2.10.x versions appear to be vulnerable.

Cheers,
Christophe

On May 22, Christophe Kalt wrote:
| Hi,
| 
| a new problem was found in the IRC server which potentially
| affects all existing versions which are configured to use
| iauth.  Exploiting this problem allow a user to generate
| network splits.
| 
| Fortunately, there is a quick fix which consists of:
| 	a) not running iauth
| or
| 	b) disabling the rfc931 module
| 
| A patch will be released early next week, to allow some time
| for admins to install the workaround described above.
| 
| Christophe